CCSP Practice Test 2 — 30 Questions

Question 1

A global company uses a cloud provider that stores data in multiple jurisdictions. During an eDiscovery request from a US court, which three challenges are most likely to arise? (Choose three.)

Accepted Answer

Jurisdictional conflicts over which court has authority. Option A is correct because when data resides in multiple jurisdictions, US court orders can conflict with local data-protection or blocking statutes (e.g., GDPR or foreign blocking laws), creating disputes over which court or legal regime has authority over the data. Option C is correct because eDiscovery requires a legal hold to preserve potentially relevant data in place, and in multi-jurisdiction cloud environments this is complicated by distributed storage, automated lifecycle deletion, and differing retention rules that can alter or destroy evidence. Option D is correct because cloud tenants typically lack physical access to the provider's hardware, so forensically sound collection must rely on provider APIs, snapshots, and chain-of-custody documentation rather than direct disk imaging, which can be challenged in court. Option B is not correct because major cloud providers offer extensive encryption options (at rest, in transit, and customer-managed keys), so lack of encryption is not an inherent eDiscovery challenge. Option E is not correct because while cloud storage costs exist, excessive cost is not a legal or forensic challenge specific to cross-jurisdiction eDiscovery and is not among the primary issues courts focus on.

Answer

Lack of encryption options

Answer

Excessive cost of cloud storage

Question 2

Which security testing approach is most effective at identifying vulnerabilities early in the cloud software development lifecycle (SDLC) by analyzing source code without executing the application?

Accepted Answer

Static Application Security Testing (SAST). Static Application Security Testing (SAST) is the correct approach because it analyzes source code, bytecode, or binary code without executing the application, making it ideal for identifying vulnerabilities early in the SDLC (shift-left). Unlike dynamic or runtime tools, SAST scans the codebase statically, catching issues like SQL injection, buffer overflows, and insecure cryptographic implementations before compilation or deployment.

Answer

Interactive Application Security Testing (IAST)

Answer

Runtime Application Self-Protection (RASP)

Answer

Dynamic Application Security Testing (DAST)

Question 3

A financial services company stores customer transaction data in a cloud object storage bucket. The company requires that all data be encrypted at rest using keys that it generates and manages on-premises, with the cloud provider having no access to the keys. Which encryption approach should the company use?

Accepted Answer

Client-side encryption with customer-owned keys. Client-side encryption with customer-owned keys means the company encrypts data before uploading it to cloud storage, and the keys never leave the company's on-premises environment. The cloud provider stores only ciphertext and has no access to the plaintext or the keys, satisfying the requirement that the provider cannot access the keys.

Answer

Server-side encryption with AES-256

Answer

Server-side encryption with bring your own key (BYOK) to cloud KMS

Answer

Server-side encryption with customer-managed keys (CMK) in cloud KMS

Question 4

What is the primary purpose of a Data Processing Agreement (DPA) between a data controller and a cloud service provider?

Accepted Answer

To define roles and responsibilities for data processing. A Data Processing Agreement (DPA) is a legally binding contract required under regulations like GDPR. Its primary purpose is to define the roles and responsibilities of the data controller and the data processor (the cloud service provider), ensuring the processor acts only on the controller's documented instructions and meets compliance obligations. Without a DPA, the controller cannot legally transfer data to the processor, as the agreement establishes the lawful basis and accountability for processing activities.

Answer

To set data retention periods for processed data

Answer

To specify encryption algorithms to be used

Answer

To establish data backup and recovery procedures

Question 5

A company is migrating sensitive customer data to a public cloud storage service. They want to ensure that even the cloud provider cannot access the plaintext data. Which encryption strategy should they implement?

Accepted Answer

Client-side encryption before uploading data. Client-side encryption ensures that data is encrypted before it leaves the customer's environment, so the cloud provider only ever receives ciphertext. This means the cloud provider cannot access the plaintext data, even if the storage service is compromised or the provider is legally compelled to disclose data. The encryption keys are managed and stored by the customer, not the cloud provider.

Answer

Server-side encryption with cloud-provider-managed keys

Answer

Tokenization of sensitive fields at the application layer

Answer

Enforcing role-based access control (RBAC) on the storage bucket

Question 6

An organization wants to share a large file from a cloud storage bucket with an external partner for a limited time. They need to ensure that the partner can only access the specific file and that the access expires automatically. Which method should they use?

Accepted Answer

Use a pre-signed URL. A pre-signed URL provides temporary access to a specific object in a cloud storage bucket, with an expiration time. It grants the external partner permission to download the file without needing a cloud account, and access automatically expires. This meets the requirements of limited-time, specific-file access.

Answer

Make the bucket public

Answer

Create a new cloud provider user account for the partner and attach a custom policy to the bucket

Answer

Use cross-region replication

Question 7

A financial institution is required to comply with the Sarbanes-Oxley Act (SOX) for its cloud-hosted financial applications. The cloud provider is responsible for the underlying infrastructure. Which of the following controls is most likely the responsibility of the financial institution as part of IT general controls (ITGC)?

Accepted Answer

Logical access controls to the financial application, including user provisioning and segregation of duties. Under the shared responsibility model, the cloud provider secures the infrastructure (data centers, hypervisors, network fabric), while the customer is responsible for controls over their own data, applications, and access. Logical access controls — user provisioning, authentication, authorization, and segregation of duties — are IT general controls that the financial institution must implement and evidence for SOX compliance, since they directly affect the integrity of financial reporting systems.

Answer

Physical security of the data center housing the cloud servers

Answer

Network intrusion detection at the cloud perimeter

Answer

Patching of the hypervisor that hosts the virtual machines

Question 8

A company is designing a data retention policy for cloud storage. Regulatory requirements mandate that certain records be kept for 7 years and then securely destroyed. Which combination of controls should be used?

Accepted Answer

Lifecycle policy and secure deletion. A lifecycle policy automates the transition and expiration of objects, allowing you to set a rule to delete objects after 7 years. Secure deletion (e.g., overwriting or cryptographic erasure) ensures the data is irrecoverable, meeting the regulatory requirement for secure destruction. Together, they provide a fully automated, auditable process for retention and destruction.

Answer

Data masking and encryption

Answer

Versioning and MFA delete

Answer

Lifecycle policy and object lock

Question 9

A SaaS provider uses a customer-managed encryption key (CMEK) model for data-at-rest. The provider's application runs in a multi-tenant cloud environment. Which attack surface is MOST directly mitigated by this approach?

Accepted Answer

Insider threats from cloud provider employees. A customer-managed encryption key (CMEK) model gives the customer control over the key used to encrypt data at rest. This directly mitigates the risk of a cloud provider employee accessing the plaintext data, because even if the employee has administrative access to the storage infrastructure, they cannot decrypt the data without the customer's key. The provider holds the encrypted data, but the decryption key is managed and controlled by the customer, creating a logical separation that protects against insider threats from the provider's personnel.

Answer

Misconfigured storage buckets exposing data

Answer

SQL injection vulnerabilities in the application

Answer

Side-channel attacks on shared physical hardware

Question 10

A financial services company uses a multi-region cloud deployment for its trading application. The application consists of a web frontend, a REST API, and a relational database. Recently, a penetration test revealed that an attacker could perform a time-based blind SQL injection through the API's search functionality. The injection allows the attacker to enumerate database contents by observing response times. The development team was already aware of the issue but had prioritized other features. The security team now demands immediate remediation. The application is critical and cannot be taken offline. Which of the following is the most effective immediate action to mitigate the risk without modifying the application code?

Accepted Answer

Deploy a Web Application Firewall (WAF) with a rule to block SQL injection patterns. A WAF can inspect incoming HTTP requests and block those matching SQL injection patterns (e.g., SQL keywords, special characters) without modifying application code. Since the vulnerability is a time-based blind SQL injection, a WAF with a dedicated SQL injection rule set can immediately stop the attack vector by filtering malicious payloads at the edge, providing a virtual patch while the code fix is developed. This is the only option that directly addresses the injection vector without requiring code changes or downtime.

Answer

Implement rate limiting on the API endpoint

Answer

Enable DDoS protection on the cloud load balancer

Answer

Enable transparent data encryption (TDE) on the database

Question 11

A cloud consumer uses an IaaS provider for storage of archived financial records. Regulatory requirements mandate that data at rest be encrypted using a key that is under the consumer's sole control. Which encryption approach should the consumer implement?

Accepted Answer

Use client-side encryption with keys stored in the consumer's on-premises HSM. Client-side encryption ensures the data is encrypted before it leaves the consumer's environment, and storing the keys in the consumer's on-premises HSM guarantees sole control over the encryption keys, meeting the regulatory requirement for data-at-rest encryption with keys under the consumer's sole control.

Answer

Use a TLS tunnel to the storage service

Answer

Enable server-side encryption with keys managed by the cloud provider

Answer

Use server-side encryption with customer-provided keys (SSE-C)

Question 12

A company is implementing a serverless application using AWS Lambda. The function processes S3 events and writes to a DynamoDB table. Which of the following is the MOST secure way to grant the necessary permissions?

Accepted Answer

Create a custom IAM role with only the required actions on specific resources. AWS Lambda functions require an IAM role (execution role) to access other AWS services. By creating a custom IAM role with only the required actions (e.g., s3:GetObject for the specific S3 bucket and dynamodb:PutItem for the specific DynamoDB table), you adhere to the principle of least privilege, minimizing the attack surface and ensuring secure, auditable access.

Answer

Use resource-based policies on the Lambda function

Answer

Attach a managed policy that grants full access to S3 and DynamoDB

Answer

Use the root user credentials of the AWS account

Question 13

A cloud service provider (CSP) includes a limitation of liability clause capped at the total fees paid in the past 12 months. A customer suffers a data breach due to provider negligence, losing $2M in business. The customer's annual spend is $500K. What is the customer's likely recovery?

Accepted Answer

Up to $500K, the total fees paid in the past 12 months. The clause limits liability to fees paid (12 months = $500K), so the customer can recover up to that amount, not the full $2M loss. Option B correctly states this limitation.

Answer

The amount of direct damages only

Answer

Full $2M because negligence overrides liability caps

Answer

Zero because the customer accepted the terms

Question 14

Which THREE of the following are recommended practices for securing cloud application APIs? (Select three.)

Accepted Answer

Validate and sanitize all user inputs. Option A is correct because validating and sanitizing all user inputs defends against injection attacks (SQLi, XSS, command injection) and malformed payloads that could compromise the API or its backend data stores. Option D is correct because rate limiting (e.g., token-bucket or fixed-window throttling at the API gateway) mitigates brute-force, credential-stuffing, and denial-of-service abuse by capping request volume per client, key, or IP. Option E is correct because applying least privilege to API keys and roles ensures each key or IAM role only grants the minimum scopes and permissions needed, limiting blast radius if credentials are leaked. Option B is wrong because automatically exposing every endpoint increases attack surface and can reveal undocumented or internal APIs; endpoints should be explicitly published and protected. Option C is wrong because mass assignment lets clients bind arbitrary fields to backend objects, enabling privilege escalation or data tampering; allowlists of assignable fields should be enforced instead.

Answer

Expose all API endpoints automatically for transparency

Answer

Allow mass assignment for ease of development

Question 15

A cloud security team is implementing a key management system for encrypting data in a multi-cloud environment. They need to ensure that keys are available even if one cloud provider experiences an outage. What is the BEST approach?

Accepted Answer

Implement a multi-cloud key management system that replicates keys across providers. A multi-cloud key management system that replicates keys across providers ensures high availability and fault tolerance. If one cloud provider experiences an outage, the keys remain accessible from another provider, preventing data decryption failures. This approach aligns with the principle of avoiding a single point of failure in key distribution, which is critical for maintaining continuous data access in a multi-cloud architecture.

Answer

Use a single cloud provider's key management service

Answer

Store encryption keys in the same storage as encrypted data

Answer

Use hardware security modules (HSMs) in one data center

Question 16

A multinational corporation is implementing a multi-cloud strategy to avoid concentration risk. The risk management team is evaluating the inherent risks of using multiple cloud providers. Which THREE risks are specifically associated with a multi-cloud strategy? (Choose three.)

Accepted Answer

Expanded attack surface due to more entry points and APIs. Option B is correct because a multi-cloud strategy adds more entry points and APIs, since each provider exposes its own management consoles, IAM endpoints, and service APIs, expanding the attack surface that must be monitored and secured. Option C is correct because consistent security policies must be enforced across heterogeneous providers with different native controls, identity models, and configuration semantics, making uniform governance and compliance far more complex. Option E is correct because each cloud platform has its own tooling, services, and operational model, so the organization needs specialized skills and expertise for each provider rather than a single unified skill set. Option A is not correct because multi-cloud generally reduces vendor lock-in rather than increasing it, since workloads can be distributed and portability is improved. Option D is not correct because data sovereignty challenges stem from where data is stored and processed across jurisdictions, which is not inherently a risk specific to using multiple cloud providers.

Answer

Higher likelihood of vendor lock-in due to proprietary services

Answer

Greater difficulty in meeting data sovereignty requirements across jurisdictions

Question 17

A cloud security architect is designing a key management strategy for a multi-cloud environment. Which of the following is a BEST practice for key management?

Accepted Answer

Use a centralized key management system that integrates with all clouds. A centralized key management system (KMS) that integrates with all cloud providers enables consistent key lifecycle management, reduces the risk of key sprawl, and ensures uniform access control policies across a multi-cloud environment. This approach aligns with the principle of separation of duties and allows for centralized auditing and rotation without vendor lock-in.

Answer

Use the same key for all data to simplify rotation

Answer

Store keys in each cloud provider's native KMS separately

Answer

Embed keys in application code for simplicity

Question 18

A cloud customer is migrating a legacy application to a cloud platform. The application currently runs on physical servers and uses local storage. The migration plan involves rehosting the application on virtual machines (VMs) in the cloud. The security team wants to ensure that the VMs are properly hardened before deployment. During the migration testing, the team discovers that the base image used for the VMs contains several unnecessary services and default credentials. The team is concerned that these vulnerabilities could be exploited. The cloud provider offers a shared responsibility model where the customer is responsible for securing the OS. Which of the following is the BEST course of action to address this issue?

Accepted Answer

Create a custom golden image with necessary hardening and approved software only. Creating a custom golden image allows the customer to enforce a hardened baseline that removes unnecessary services, disables default credentials, and includes only approved software before any VM is deployed. This aligns with the shared responsibility model, where the customer controls OS-level security, and prevents vulnerabilities from ever reaching production. Pre-hardening the image is more secure and efficient than fixing issues post-deployment, as it eliminates the window of exposure during initial boot and configuration.

Answer

Deploy the VMs and run vulnerability scans to identify and fix issues after deployment

Answer

Ask the cloud provider to provide a hardened OS image

Answer

Deploy the VMs and manually apply security patches and remove services after deployment

Question 19

A company has a disaster recovery (DR) plan that includes failing over to a secondary cloud region. The plan was tested six months ago and worked, but since then significant infrastructure changes have been made. Which of the following should the company do to ensure the DR plan remains effective?

Accepted Answer

Conduct a tabletop exercise now, followed by a partial failover test of critical applications.. After significant infrastructure changes, the DR plan may no longer be valid. A tabletop exercise quickly identifies gaps in the plan and updates documentation, while a partial failover test of critical applications validates that the changes work in practice without the risk of a full-scale failover. This combined approach ensures the plan remains effective and current.

Answer

Wait until the next annual DR test to verify the changes.

Answer

Automate the entire failover process to eliminate human error.

Answer

Update the DR documentation to reflect the changes and assume the plan still works.

Question 20

A cloud customer is decommissioning a storage service that contains sensitive data. The cloud provider offers several data destruction options. Which method provides the HIGHEST assurance that data is irrecoverable?

Accepted Answer

Physical shredding of the storage drives. Physical shredding of the storage drives provides the highest assurance that data is irrecoverable because it physically destroys the media, making it impossible to reconstruct any data. Unlike degaussing, which may leave residual magnetization, or overwriting, which can leave data in bad sectors, shredding reduces the drives to small particles that cannot be reassembled. Cryptographic erasure is effective only if the encryption keys are securely destroyed and the encryption was properly implemented, but it still relies on the encryption being unbreakable.

Answer

Degaussing the storage media

Answer

Multiple overwrite passes with zeros and ones

Answer

Cryptographic erasure of encryption keys